A site goes through OpenWAF when its name answers with the OpenWAF edge. There are two ways to get there; choose one per domain:
| Delegated (recommended) | External | |
|---|---|---|
| Dashboard option | Use OpenWAF nameservers | Keep your current DNS (CNAME/A records) |
| Who answers DNS | OpenWAF, for every name of the domain | Your current DNS provider |
| What you change | The nameservers at the registrar | One TXT record, then one CNAME (or A/AAAA) per site |
| Activation | When the registrar delegates the domain to your pair | When the TXT record is visible |
| Good for | Most domains: everything in one place | Domains registered at Cloudflare Registrar, or when the DNS must stay where it is |
Read Delegated and external zones for the full comparison. You need the tech role or higher.
Before you start
- Add the registrable domain (
example.com), not a subdomain or a URL. Subdomains such aswwworshopare names inside the domain. - Know the address of your origin: the server that answers the site today (an IP address or a host name).
- New sites connect to the origin over HTTPS and verify its certificate (Full strict). If your origin only speaks HTTP or has a self-signed certificate, see SSL/TLS before you proxy the site.
- The WAF is on for new domains, in blocking mode at medium sensitivity. See WAF to start in log-only mode.
Delegated domain
Add the domain. In the dashboard, open Add domain, enter
example.comand choose Use OpenWAF nameservers (recommended). Optionally, pick the client it belongs to. Select Add domain.Domains › Add domain, as above. Right after you sign up, the same form opens as Let's protect your first site.
openwaf-cloud ctl zones add example.com --reason "Add example.com"curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \ -H "Authorization: Bearer $OPENWAF_TOKEN" \ -H "Content-Type: application/json" \ -H "X-Change-Reason: Add example.com" \ -d '{"name": "example.com", "dns_mode": "delegated"}'The answer (
201) includes the zoneid, itsns_pairand how many public records were imported.Ask your assistant: “Add example.com to OpenWAF using OpenWAF nameservers.” It calls
add_zonewithmode: "delegated", shows you the plan, and applies it only after you confirm.Review the DNS records. OpenWAF copies the records your domain publishes today (and names found in public certificate logs) into the new zone, without proxy. Check that everything is there, especially mail (
MX,TXT): after the switch, only these records will resolve. Select Scan again to look for more, or add records by hand. See Manage DNS records.Change the nameservers at your registrar. Replace all the current nameservers of the domain with exactly the two names shown (your organization's pair). Disable DNSSEC at the registrar first if it is enabled. The dashboard has step-by-step instructions for common registrars and shows the delegation status live. See Delegate a zone to OpenWAF.
Wait for activation. OpenWAF checks the delegation every few minutes and activates the domain as soon as the registry and public resolvers show your pair. It usually takes minutes to a few hours, up to 48 hours for some top-level domains. Select Check now to check immediately.
Turn on the proxy for your sites. In DNS › Records, switch Proxy status to Proxied on the
A,AAAAorCNAMErecords of each site to protect (for exampleexample.comandwww). Their content becomes the origin the edge connects to. See Proxied and DNS-only records.Let the certificates issue. OpenWAF issues the HTTPS certificates automatically, usually within a couple of minutes. The domain's Overview shows when every site is protected.
External domain
Add the domain. Open Add domain, enter
example.comand choose Keep your current DNS (CNAME/A records).Domains › Add domain › Keep your current DNS (CNAME/A records).
openwaf-cloud ctl zones add example.com --mode external --reason "Add example.com"curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \ -H "Authorization: Bearer $OPENWAF_TOKEN" \ -H "Content-Type: application/json" \ -H "X-Change-Reason: Add example.com" \ -d '{"name": "example.com", "dns_mode": "external"}'Ask your assistant: “Add example.com to OpenWAF and keep its current DNS.” It calls
add_zonewithmode: "external".List the sites to protect. For each one, enter the name (
www, or@forexample.comitself) and its origin (203.0.113.10ororigin.example.net). Each site becomes a proxied record in the zone.Verify that the domain is yours. At your current DNS provider, create the TXT record shown:
_openwaf.example.com. TXT "openwaf-verify=<token>"OpenWAF looks for it every few minutes (or when you select Check now) and activates the domain when a public resolver sees it. See Keep your DNS provider.
Point each site to OpenWAF. Only after the domain is active, change each site's record at your DNS provider:
www.example.com. CNAME edge.openwaf.dev.At the root of the domain, where a CNAME is not allowed, create
AandAAAArecords with the edge addresses shown in DNS › Settings, or a CNAME if your provider flattens it.Check the pointing. The domain's Overview shows whether each site points to OpenWAF. HTTPS certificates are issued automatically a few minutes after a site points here.